#!/bin/bash
# VIP
APISERVER_VIP=192.168.56.110
MASTER01=192.168.56.11
MASTER02=192.168.56.12
MASTER03=192.168.56.13
# PROXY=192.168.0.109:10809
# The SERVICE_CIDR_FIRST_IP is usually the first IP from the service CIDR that is specified as the --service-cluster-ip-range argument for both the API server and the controller manager component
# SERVICE CIDR 在apiserver 和 controller-manager 设置为 10.96.0.0/16
SERVICE_CIDR_FIRST_IP=10.96.0.1
EASY_RSA_VERSION=3.1.6


mkdir -p ~/easyRsa
curl --proxy $PROXY -L -o ~/easyRsa/EasyRSA-$EASY_RSA_VERSION.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v$EASY_RSA_VERSION/EasyRSA-$EASY_RSA_VERSION.tgz

rm -rf ~/easyRsa/EasyRSA-$EASY_RSA_VERSION
tar Cxzvf ~/easyRsa ~/easyRsa/EasyRSA-$EASY_RSA_VERSION.tgz
# USER=`whoami`
# GROUPS=`groups`
# chown -R ${USER}:${GROUPS} EasyRSA-3.1.6
cd ~/easyRsa/EasyRSA-$EASY_RSA_VERSION

./easyrsa init-pki
# 生成新的证书颁发机构（CA）。参数 --batch 用于设置自动模式； 参数 --req-cn 用于设置新的根证书的通用名称（CN）。
# ./easyrsa --batch "--req-cn=$MASTER01@`date +%s`" build-ca nopass
./easyrsa --batch "--req-cn=kubernetes" build-ca nopass

# 修改x509-types中的server配置
# sed -i 's/extendedKeyUsage = serverAuth/extendedKeyUsage = serverAuth,clientAuth/; s/keyUsage = digitalSignature,keyEncipherment/keyUsage = digitalSignature,keyEncipherment,nonRepudiation/' ./x509-types/server

# 生成服务器证书和秘钥
# kube-apiserver证书
./easyrsa --batch --req-cn="kube-apiserver" gen-req kube-apiserver nopass
./easyrsa --batch --req-cn="front-proxy-client" gen-req front-proxy-client nopass
./easyrsa --batch --req-cn="etcd" gen-req etcd nopass
./easyrsa --batch --req-cn="system:kube-controller-manager" gen-req kube-controller-manager nopass
./easyrsa --batch --req-cn="system:kube-scheduler" gen-req kube-scheduler nopass
./easyrsa --batch --req-cn="system:kube-proxy" gen-req kube-proxy nopass
./easyrsa --batch --dn-mode=org --req-cn=admin --req-org=system:masters gen-req admin nopass

./easyrsa --batch --subject-alt-name="IP:127.0.0.1,"\
"IP:$APISERVER_VIP,"\
"IP:$MASTER01,"\
"IP:$MASTER02,"\
"IP:$MASTER03,"\
"IP:$SERVICE_CIDR_FIRST_IP,"\
"DNS:kubernetes,"\
"DNS:kubernetes.default,"\
"DNS:kubernetes.default.svc,"\
"DNS:kubernetes.default.svc.cluster,"\
"DNS:kubernetes.default.svc.cluster.local" \
--days=10000 \
sign-req serverClient kube-apiserver
./easyrsa --batch --days=10000 sign-req serverClient front-proxy-client
./easyrsa --batch --subject-alt-name="IP:127.0.0.1,IP:$MASTER01,IP:$MASTER02,IP:$MASTER03,DNS:*.etcd.com" --days=10000 sign-req serverClient etcd
./easyrsa --batch --days=10000 sign-req serverClient kube-controller-manager
./easyrsa --batch --days=10000 sign-req serverClient kube-scheduler
./easyrsa --batch --days=10000 sign-req serverClient kube-proxy
./easyrsa --batch --days=10000 sign-req serverClient admin


# 检查admin证书是否存在system:masters
# openssl x509 -in ~/easyRsa/EasyRSA-3.1.6/pki/issued/admin.crt -text -noout

rm -rf ~/easyRsa/pki
mkdir -p ~/easyRsa/pki

# Create ServiceAccount Key
openssl genrsa -out ~/easyRsa/pki/sa.key 2048
openssl rsa -in ~/easyRsa/pki/sa.key -pubout -out ~/easyRsa/pki/sa.pub
cp ~/easyRsa/EasyRSA-$EASY_RSA_VERSION/pki/*.crt ~/easyRsa/pki
cp ~/easyRsa/EasyRSA-$EASY_RSA_VERSION/pki/issued/*.crt ~/easyRsa/pki
cp ~/easyRsa/EasyRSA-$EASY_RSA_VERSION/pki/private/*.key ~/easyRsa/pki


ssh vagrant@$MASTER02 "mkdir -p ~/easyRsa/pki"
ssh vagrant@$MASTER03 "mkdir -p ~/easyRsa/pki"
scp ~/easyRsa/pki/* vagrant@$MASTER02:~/easyRsa/pki
scp ~/easyRsa/pki/* vagrant@$MASTER03:~/easyRsa/pki

sudo rm -rf /etc/kubernetes/pki && sudo mkdir -p /etc/kubernetes/pki && sudo mv ~/easyRsa/pki/* /etc/kubernetes/pki
ssh vagrant@$MASTER02 "sudo rm -rf /etc/kubernetes/pki && sudo mkdir -p /etc/kubernetes/pki && sudo mv ~/easyRsa/pki/* /etc/kubernetes/pki"
ssh vagrant@$MASTER03 "sudo rm -rf /etc/kubernetes/pki && sudo mkdir -p /etc/kubernetes/pki && sudo mv ~/easyRsa/pki/* /etc/kubernetes/pki"